macOS: Suspicious Shell/Python Child Processes Spawned by Microsoft Office Apps

Alerts when Microsoft Office on macOS launches suspicious shell/script or download utilities as child processes.

FreeUnreviewedSigmahighv1

macos-suspicious-shell-python-child-processes-spawned-by-microsoft-office-apps-69483748

title: "macOS: Suspicious Shell/Python Child Processes Spawned by Microsoft Office Apps"
id: d75ca91d-084c-480f-b739-dba4eebdc928
status: test
description: This rule flags process creation events where a Microsoft Office application (Word, Excel, PowerPoint, or OneNote) spawns a child process with an image path ending in common scripting or download utilities such as /bash, /curl, /osascript, /osacompile, /python, /wget, or shells like /zsh and /sh. Attackers can use Office content (e.g., macros or scripts) to launch external commands, enabling execution outside the Office app. The detection relies on macOS process creation telemetry and matching parent application names to child executable filename endings.
references:
  - https://redcanary.com/blog/applescript/
  - https://objective-see.org/blog/blog_0x4B.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_office_susp_child_processes.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-01-31
modified: 2023-02-04
tags:
  - attack.execution
  - attack.persistence
  - attack.t1059.002
  - attack.t1137.002
  - attack.t1204.002
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    ParentImage|contains:
      - Microsoft Word
      - Microsoft Excel
      - Microsoft PowerPoint
      - Microsoft OneNote
    Image|endswith:
      - /bash
      - /curl
      - /dash
      - /fish
      - /osacompile
      - /osascript
      - /sh
      - /zsh
      - /python
      - /python3
      - /wget
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 69483748-1525-4a6c-95ca-90dc8d431b68
    type: derived

What it detects

This rule flags process creation events where a Microsoft Office application (Word, Excel, PowerPoint, or OneNote) spawns a child process with an image path ending in common scripting or download utilities such as /bash, /curl, /osascript, /osacompile, /python, /wget, or shells like /zsh and /sh. Attackers can use Office content (e.g., macros or scripts) to launch external commands, enabling execution outside the Office app. The detection relies on macOS process creation telemetry and matching parent application names to child executable filename endings.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.